ks2: ks4 pull leg and its WireGuard tunnel move from nuc to nas

nuc-seed.md -> nas-seed.md. The leg was designed around nuc's USB pool,
which is exactly the device it must not depend on. Target pool ks4backup
now lives on tank; nas becomes WG peer 10.8.0.22 and nuc's tunnel retires
once seeded — nuc no longer needs one at all, since transmission-bt (the
only other user) moved to nas with its own in-container tunnel.

ks4 needs no change: traffic arrives masqueraded as the wireguard
container whichever peer sent it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

ks2/decommission.md

@@ -8,8 +8,8 @@ few days of margin.
 
 - [ ] restic S3 leg running nightly for ≥ a week, `done (rc=0)`,
       restore test passed ([restic-backup.md](../ks4/restic-backup.md) §7)
-- [ ] nuc pull leg seeded and one instance test-restored
-      ([nuc-seed.md](nuc-seed.md))
+- [ ] **nas** pull leg seeded and one instance test-restored
+      ([nas-seed.md](nas-seed.md))
 - [ ] local leg (sdb5) cron green in `/var/log/incus-copy.log`
 
 ## 1. Cut the last flows to ks2 (root on ks4)